300-415 Question 243
Single answerAn enterprise has deployed Cisco SD-WAN across its branch locations and wishes to enhance DNS security by mitigating DNS-based threats such as phishing and command-and-control (C2) domains. The administrator has enabled DNS security on the SD-WAN fabric. Which configuration step is required to ensure DNS security functions correctly?
- A
Enable DNS security policy under the centralized data policy and assign it to appropriate sites.
- B
Configure Umbrella DNS integration within the vManage DNS parameters.
- C
Ensure that DNS traffic is directed to Cisco Umbrella resolvers within the transport locators.
- D
Activate DNS reputation filtering in the application-aware routing policy.
Show answer and explanation
Correct answer: A
Explanation
To implement DNS security in Cisco SD-WAN, administrators must configure and enable DNS security policies within the centralized data policy and ensure they are applied to the appropriate branch locations. These policies are responsible for filtering and mitigating DNS-based threats such as phishing and malicious domains. While Umbrella DNS integration and other features complement DNS security, they are not mandatory for the initial DNS security configuration.
- A. Correct.
Correct: DNS security in Cisco SD-WAN is implemented through centralized policies that specify DNS filtering rules, which must be assigned to the relevant sites.
- B. Incorrect.
Incorrect: While Umbrella DNS integration enhances DNS security, it is not directly required for enabling DNS security in Cisco SD-WAN.
- C. Incorrect.
Incorrect: Directing DNS traffic to Cisco Umbrella resolvers is a valid option for DNS security but not the required step for DNS security functionality in SD-WAN.
- D. Incorrect.
Incorrect: DNS reputation filtering is not a feature of application-aware routing policy; it is handled through DNS security policies.